What happens if Bitcoin crashes?

Stackit.ai's rules engine auto-repays your loan to keep your LTV in a safe range. Worst case is less borrowing power — not losing your BTC. The system is designed to protect your position, not liquidate it.

How much does Stackit.ai cost?

Stackit charges 2% on deposits, 2% when USDC converts into BTC or ETH, and 2% per borrowing execution — including the automated re-leverage cycles that rebuild your position as prices recover. Everything that protects you or pays you back is free: auto-repay, deleveraging, parking, selling to USDC, repaying, withdrawing, and leaving.

Is my crypto safe with Stackit.ai?

Stackit.ai operates on a self-custody model — your assets stay in wallets you control. You hold your own keys. Built on Privy and Bridge (both owned by Stripe) across Base, Arbitrum, and Polygon — trusted, institutional-grade infrastructure.

What if I stop depositing?

Your Health Score adjusts and Stackit.ai shifts to defense mode. The system protects what you've already built. You can resume deposits anytime.

Can AI agents use Stackit.ai?

Yes. Stackit.ai provides API access for AI agents with hard limits. Agents can deposit and spend within the same safety rails as human users. Both humans and AI agents use the same protected system.

Is Stackit.ai the same as STACKIT or StackAI?

No. Stackit.ai (stackit.ai) is a crypto treasury management platform for businesses. STACKIT (stackit.cloud) is a European cloud provider by Schwarz IT (Lidl/Kaufland parent). StackAI (stack-ai.com) is a no-code AI workflow builder. These are three completely different companies.

← Security

Bug Bounty

Security review is a continuous layer, not a single checkbox.

Stackit treats audits as one trust layer, not the only trust layer. Our current approach combines limited permissions, public fee rules, sandbox testing, bug bounty review, policy-based automation, and user self-rescue paths.

Last updated June 25, 2026

Program history

This public bug bounty history page was added on June 25, 2026 to make the review process visible to agents, developers, and users. Submission counts and remediation history will be updated as reports are received and resolved.

Current bounty

Report security issues to support@stackit.ai with a concise reproduction, affected route/tool, expected impact, and safe proof. Do not include private keys, seed phrases, production customer data, or destructive exploit steps.

Scope

Contracts and transaction envelopes

Policy checks, unsigned transaction preparation, relay flow, replay protection, and wallet-sovereign assumptions.

API

Public demo endpoints, sandbox endpoints, auth boundaries, typed safety errors, idempotency, and rate limits.

MCP

Tool schemas, tool-call boundaries, auth-required behavior, and prompt-injection-sensitive responses.

App and docs

Misleading safety copy, broken recovery paths, exposed sensitive data, or instructions that could cause unsafe execution.

Results and fix history

Submissions received	Not yet publicly reported
Valid issues	Not yet publicly reported
Critical severity	None publicly reported
High severity	None publicly reported
Fix history	Published fix notes will be added here as valid bounty reports are remediated.

Limitations

A bug bounty does not guarantee safety. It complements scoped permissions, public fee rules, sandbox testing, policy-based automation, self-rescue docs, internal review, and future third-party audits.

Audit status and roadmap

Stackit.ai is not currently presenting a completed third-party smart contract audit. Audit scope, firm, date, findings, and remediation notes should be published as that layer is completed.

Security model Trust checklist Self-rescue